[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbFTIZ8DSVB62uKzTIV6o9fwO4DhnTkchQ9y5WV5GxcM":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":46},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"26bcd5a7-c391-40ad-a36e-3041e13897df","Tietosuojavaltuutetun toimisto (Finland) - TSV\u002F5175\u002F2025","tietosuojavaltuutetun-toimisto-finland-tsv-5175-2025-eadeab","Created page with \"{{DPAdecisionBOX |Jurisdiction=Finland |DPA-BG-Color= |DPAlogo=LogoFI.png |DPA_Abbrevation=Tietosuojavaltuutetun toimisto |DPA_With_Country=Tietosuojavaltuutetun toimisto (Finland) |Case_Number_Name=TSV\u002F5175\u002F2025 |ECLI= |Original_Source_Name_1=Finlex |Original_Source_Link_1=https:\u002F\u002Fwww.finlex.fi\u002Ffi\u002Fviranomaiset\u002Ftietosuojavaltuutettu\u002F2026\u002F35 |Original_Source_Language_1=Finnish |Original_Source_Language__Code_1=FI |Original_Source_Name_2= |Original_Source_Link_2= |Or...\" Show changes","Finland's Data Protection Ombudsman has fined Plastic Surgery Center Helsinki Oy €20,200 for failing to comply with an order to provide a data subject access to their patient records. The clinic repeatedly ignored requests for information between 2016 and 2025, and even after a DPA order in June 2026, the provided data was insufficient and did not include all required details.","Finnish DPA fines plastic surgery clinic €20,200 for failing to provide patient records.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Tietosuojavaltuutetun_toimisto_(Finland)_-_TSV\u002F5175\u002F2025&diff=53460&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F87\u002FLogoFI.png","2026-10-19T11:45:49+00:00","2026-10-19T12:00:12.516593+00:00",7,[17],{"name":18,"type":19},"Plastic Surgery Center Helsinki Oy","vendor","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":20,"icon":22,"name":23,"slug":24},null,"Privacy Fines","privacy-fines",[26,31,36],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":38,"icon":22,"name":39,"slug":40},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",[],[18],{"controls":44,"vendors":45},[],[],{"slug":47,"title":48,"body":49,"framework_refs":50,"framework_notes":58},"finnish-clinic-fined-20200-for-ignoring-patient-data-access-rights-over-nine-years","Finnish Clinic Fined €20,200 for Ignoring Patient Data Access Rights Over Nine Years","Plastic Surgery Center Helsinki repeatedly failed to honour a patient's legal right to access their own medical records, spanning from 2016 to 2025 — and even after a formal DPA enforcement order, the clinic's response was incomplete. This case illustrates that GDPR compliance is not just about preventing breaches; it equally requires organisations to actively fulfil data subject rights in a timely and complete manner. Ignoring or inadequately responding to subject access requests (SARs) exposes organisations to regulatory fines and reputational damage. Healthcare providers, who handle highly sensitive personal data, bear a heightened duty of care under data protection law.",[51,52,53,54,55,56,57],"GDPR Article 32","GDPR Article 15","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"GDPR Article 15":59,"GDPR Article 32":60,"NIST SP 800-53 SI-2: Flaw Remediation":61,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":62,"CIS Control 17: Incident Response Management":63,"CIS Control 14: Security Awareness and Skills Training":64,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":65},"Article 15 enshrines the data subject's right of access to their personal data; the clinic's repeated non-compliance with this right over nine years is the direct cause of the regulatory fine.","Article 32 requires appropriate technical and organisational measures to ensure data security and compliance; the clinic's failure to implement any workable SAR process represents a fundamental organisational control failure under this obligation.","While typically applied to technical flaws, SI-2's principle of identifying and remediating known deficiencies on a structured timeline directly applies to the clinic's failure to correct its SAR process even after regulatory intervention.","Clause 7.2 requires organisations to ensure personnel are competent in their roles; the clinic's failure to correctly fulfil SARs indicates staff lacked adequate training and understanding of data subject rights obligations.","CIS Control 17 calls for a structured response process when compliance failures or regulatory orders arise; a defined incident response plan would have ensured the DPA enforcement order was acted upon completely and promptly.","CIS Control 14 mandates ongoing training so that all staff understand their data handling responsibilities; trained personnel would have recognised and acted on SAR obligations before regulatory escalation occurred.","The NIST CSF Protect function requires organisations to manage access to information appropriately, including ensuring that data subjects can lawfully access records pertaining to them — a control the clinic chronically failed to implement."]